When you use IWP, you publish the entire database, but you can use scripts and buttons to control what the user can see and do in the database. The scripts can distinguish users connecting via web from other users and then can select data and/or layouts accordingly--so you could design layouts that only present the info you want your web users to see and limit their access to just those layouts.

I use IWP for this very purpose, to grant certain users access to a single form via the web, and it is incredibly easy to set up.

My database has a script that runs whenever the user logs in to the database. Depending on the privilege set of the user logging in, they are taken to a specific layout, etc. It is a very in-depth script to that handles many privilege sets, but this is the part I have set up for anyone logging in via IWP